OLD | NEW |
(Empty) | |
| 1 # =================== |
| 2 # AFL "Life Pro Tips" |
| 3 # =================== |
| 4 # |
| 5 # Bite-sized advice for those who understand the basics, but can't be bothered |
| 6 # to read or memorize every other piece of documentation for AFL. |
| 7 # |
| 8 |
| 9 % |
| 10 |
| 11 Get more bang for your buck by using fuzzing dictionaries. |
| 12 See dictionaries/README.dictionaries to learn how. |
| 13 |
| 14 % |
| 15 |
| 16 You can get the most out of your hardware by parallelizing AFL jobs. |
| 17 See docs/parallel_fuzzing.txt for step-by-step tips. |
| 18 |
| 19 % |
| 20 |
| 21 Improve the odds of spotting memory corruption bugs with libdislocator.so! |
| 22 It's easy. Consult libdislocator/README.dislocator for usage tips. |
| 23 |
| 24 % |
| 25 |
| 26 Want to understand how your target parses a particular input file? |
| 27 Try the bundled afl-analyze tool; it's got colors and all! |
| 28 |
| 29 % |
| 30 |
| 31 You can visually monitor the progress of your fuzzing jobs. |
| 32 Run the bundled afl-plot utility to generate browser-friendly graphs. |
| 33 |
| 34 % |
| 35 |
| 36 Need to monitor AFL jobs programmatically? Check out the fuzzer_stats file |
| 37 in the AFL output dir or try afl-whatsup. |
| 38 |
| 39 % |
| 40 |
| 41 Puzzled by something showing up in red or purple in the AFL UI? |
| 42 It could be important - consult docs/status_screen.txt right away! |
| 43 |
| 44 % |
| 45 |
| 46 Know your target? Convert it to persistent mode for a huge performance gain! |
| 47 Consult section #5 in llvm_mode/README.llvm for tips. |
| 48 |
| 49 % |
| 50 |
| 51 Using clang? Check out llvm_mode/ for a faster alternative to afl-gcc! |
| 52 |
| 53 % |
| 54 |
| 55 Did you know that AFL can fuzz closed-source or cross-platform binaries? |
| 56 Check out qemu_mode/README.qemu for more. |
| 57 |
| 58 % |
| 59 |
| 60 Did you know that afl-fuzz can minimize any test case for you? |
| 61 Try the bundled afl-tmin tool - and get small repro files fast! |
| 62 |
| 63 % |
| 64 |
| 65 Not sure if a crash is exploitable? AFL can help you figure it out. Specify |
| 66 -C to enable the peruvian were-rabbit mode. See section #10 in README for more. |
| 67 |
| 68 % |
| 69 |
| 70 Trouble dealing with a machine uprising? Relax, we've all been there. |
| 71 Find essential survival tips at http://lcamtuf.coredump.cx/prep/. |
| 72 |
| 73 % |
| 74 |
| 75 AFL-generated corpora can be used to power other testing processes. |
| 76 See section #2 in README for inspiration - it tends to pay off! |
| 77 |
| 78 % |
| 79 |
| 80 Want to automatically spot non-crashing memory handling bugs? |
| 81 Try running an AFL-generated corpus through ASAN, MSAN, or Valgrind. |
| 82 |
| 83 % |
| 84 |
| 85 Good selection of input files is critical to a successful fuzzing job. |
| 86 See section #5 in README (or docs/perf_tips.txt) for pro tips. |
| 87 |
| 88 % |
| 89 |
| 90 You can improve the odds of automatically spotting stack corruption issues. |
| 91 Specify AFL_HARDEN=1 in the environment to enable hardening flags. |
| 92 |
| 93 % |
| 94 |
| 95 Bumping into problems with non-reproducible crashes? It happens, but usually |
| 96 isn't hard to diagnose. See section #7 in README for tips. |
| 97 |
| 98 % |
| 99 |
| 100 Fuzzing is not just about memory corruption issues in the codebase. Add some |
| 101 sanity-checking assert() / abort() statements to effortlessly catch logic bugs. |
| 102 |
| 103 % |
| 104 |
| 105 Hey kid... pssst... want to figure out how AFL really works? |
| 106 Check out docs/technical_details.txt for all the gory details in one place! |
| 107 |
| 108 % |
| 109 |
| 110 There's a ton of third-party helper tools designed to work with AFL! |
| 111 Be sure to check out docs/sister_projects.txt before writing your own. |
| 112 |
| 113 % |
| 114 |
| 115 Need to fuzz the command-line arguments of a particular program? |
| 116 You can find a simple solution in experimental/argv_fuzzing. |
| 117 |
| 118 % |
| 119 |
| 120 Attacking a format that uses checksums? Remove the checksum-checking code or |
| 121 use a postprocessor! See experimental/post_library/ for more. |
| 122 |
| 123 % |
OLD | NEW |